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A working free-space quantum key distribution (QKD) 
system has been developed and tested over a 205-m indoor 
optical path at Los Alamos National Laboratory under fluo- 
rescent lighting conditions. Results show that free-space QKD 
can provide secure real-time key distribution between parties 
who have a need to communicate secretly. 

PACS Numbers: 42.79.Sz, 03.65-w 



Quantum cryptography was introduced in the mid- 
1980s as a new method for generating the shared, 
secret random number sequences, or cryptographic keys, 
that are used in crypto-systems to provide communi- 
cations security. The appeal of quantum cryptography 
is that its security is based on laws of Nature, in con- 
trast to existing methods of key distribution that derive 
their security from the perceived intractability of certain 
problems in number theory, or from the physical secu- 
rity of the distribution process. Since the introduction 
of quantum cryptography, several groups have demon- 
strated that quantum key distribution (QKD) can be 
performed over multi-kilometer distances of optical fiber 
0- ||, but the utility of the method would be greatly en- 
hanced if it could also be performed over free-space paths, 
such as are used in laser communications systems. Indeed 
there are certain key distribution problems in this cate- 
gory for which QKD would have definite practical advan- 
tages (for example, it is impractical to send a courier to 
a satellite). We are developing QKD for use over line-of- 
sight paths, including surface to satellite, and here we re- 
port our first results on key generation over indoor paths 
of up to 205 m. 

The feasibility of QKD over free-space paths might be 
considered problematic because it requires the transmis- 
sion of single photons through a medium with varying 
properties and detection of these photons against a high 
background. However, others have shown that the combi- 
nation of sub-nanosecond timing, narrow filters 0,0, 
and spatial filtering can render both of these problems 
tractable. Furthermore, the atmosphere is essentially 
non-birefringent at optical wavelengths, allowing faith- 
ful transmission of the single-photon polarization states 
used in QKD. 



A QKD procedure starts with the sender, "Alice," gen- 
crating a secret random binary number sequence. For 
each bit in the sequence, Alice prepares and transmits 
a single photon to the recipient, "Bob," who measures 
each arriving photon and attempts to identify the bit 
value Alice has transmitted. Alice's photon state prepa- 
rations and Bob's measurements are chosen from sets of 
non-orthogonal possibilities. For example, in the B92 
protocol |r| Alice agrees with Bob (through public dis- 
cussion) that she will transmit a horizontally-polarized 
photon, \h), for each "0" in her sequence, and a right- 
circular-polarized photon, | rep), for each "1" in her se- 
quence. Bob agrees with Alice to randomly test the po- 
larization of each arriving photon in one of two ways: he 
either tests with vertical polarization, \v), to reveal "Is," 
or left-circular polarization, \lcp), to reveal "Os." Note 
that Bob will never detect a photon for which he and Al- 
ice have used a preparation/measurement pair that cor- 
responds to different bit values, such as \h) and \v), which 
happens for 50% of the bits in Alice's sequence. However, 
for the other 50% of Alice's bits where the preparation 
and measurement protocols agree, such as \h) and \lcp), 
there is a 50% probability that Bob detects the photon, as 
shown in TABLE I. So, by detecting photons Bob is able 
to identify a random 25% portion of the bits in Alice's 
sequence, assuming no bit loss in transmission or detec- 
tion. (This 25% efficiency factor is the price that Alice 
and Bob must pay for secrecy.) Bob then communicates 
to Alice over a public channel the locations, but not the 
bit values, in the sequence where he detected photons, 
and Alice retains only these detected bits from her initial 
sequence. The resulting detected bit sequences are the 
raw key material from which a pure key is distilled using 
classical error detection techniques. An eavesdropper, 
"Eve," can neither "tap" the key transmissions, owing 
to the indivisibility of a photon p3| , pd|, nor copy them 
owing to the quantum "no-cloning" |15|- |L8| theorem. 
Furthermore, the non-orthogonal nature of the quantum 
states ensures that if Eve makes her own measurements 
she will be detected through the elevated error rate she 
causes by the irreversible "collapse of the wavefunction" 
II- 

The prototype QKD transmitter (FIG. 1) consisted of 
a temperature controlled diode laser, a collimating lens, 
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two dielectric mirrors, a fiber to free-space launch system, 
a single-mode fiber pigtailed polarization neutral beam- 
splitter, a variable optical attenuator (OA), a ~ fO-m 
single-mode optical fiber delay, a 2.5 nm bandwidth in- 
terference hltcr (IF), a polarizing beamsplitter (PBS), a 
low- voltage pockels cell (PC), and an 8x beam expander 
(BE). 

The diode laser wavelength is temperature selected to 
772 nm, and the laser is configured to emit a short, weak 
coherent pulse of ~ I ns length, containing approximately 
I0 5 photons. 

The free-space QKD receiver (FIG. 2) was comprised 
of a 3.5 in. Cassegrain telescope (CT), a free-space to 
fiber launch system, a single-mode fiber pigtailed polar- 
ization neutral beamsplitter, two sets of polarization con- 
trollers (each consisting of a quarter-wave retarder and a 
half- wave retarder), a PBS, and a single photon count- 
ing module, or SPCM (EG&G part number: SPCM-AQ 
142-FL). The prototype receiver did not include an in- 
terference filter but it is expected that future versions of 
the receiver will incorporate this feature to reduce back- 
ground light levels. 

A computer control system, "Alice," starts the QKD 
protocol by pulsing the diode laser at a rate previously 
agreed upon between herself and the receiving computer 
control system, "Bob." Each laser pulse is launched into 
a single-mode optical fiber and then split by the beam- 
splitter with equal probability between the direct path 
and the delay path. The direct path produces a coherent 
"bright pulse" of ~ 10 5 photons which Bob uses as his 
system trigger for timing purposes. 

Light traveling along the direct path passes through 
the IF, the PBS, the PC, and is then launched into free- 
space from the BE. The IF constrains wavelength, and 
the PBS is oriented to transmit horizontal polarization. 

The fiber delay and OA are used to delay the diverted 
pulse by ~ 50 ns as well as attenuate the diverted pulse 
to an average of ~ 1.4 photons per pulse. This atten- 
uated pulse then impinges again upon the beamsplit- 
ter, which transmits a dim-pulse with and average of 
~ 0.7 photons that follows the bright pulse along the 
direct path through the IF, the PBS, the PC, and the 
BE. (The attenuated pulse only approximates a "single- 
photon" state; we tested out the system with an average 
of ~ 0.7 photons per "dim-pulse." This corresponds to a 
2-photon probability of ~ 12% and implies that ~ 30% 
of the detectable dim-pulses will contain 2 or more pho- 
tons, e.g., with a Poisson distribution with an average 
photon number of 0.7 there will be ~ 50 empty sets, 
~ 35 sets of 1 photon, ~ 12 sets of 2 photons, and ~ 3 
sets of 3 photons for every 100 dim-pulses.) The PBS 
transmits the \h) dim-pulse to the PC which is randomly 
switched to affect only the dim-pulse polarization. The 
random switch setting is determined by discriminating a 
random voltage generated by a white noise source and 
either passes the dim-pulse unchanged as \h) (zero- wave 



retardation) or changes it to \rcp) (quarter- wave retar- 
dation), depending on the random bit value. The bright 
pulse's polarization is never altered. 

Bob then collects the bright- and dim-pulses with the 
Cassegrain telescope and launches them into single-mode 
fiber. The bright pulse is split at the beamsplitter along 
two independent paths — one path [the long path (LP)] is 
approximately 5 ns longer than the other path [the short 
path (SP)]. Each path contains polarization controlling 
optics which terminate upon the PBS. We configured our 
system to operate with a single SPCM, but we have also 
operated with SPCMs at both of the output ports of the 
PBS. 

If the dim-pulse of ~ 0.7 photons is collected and 
launched into the fiber at the receiver it will be diverted 
by the beamsplitter with equal probability along one of 
the two possible optical paths. In the prototype system 
the polarization controlling optics were adjusted to be- 
have together as a quarter-wave retarder along the SP, 
and a zero- wave retarder along the LP. Thus, a dim-pulse 
of \rcp) traveling the SP is converted to \v) and reflected 
away from the SPCM. Conversely, a dim-pulse of \h) 
traveling the SP is converted to \rcp) and is transmit- 
ted toward or reflected away from the SPCM with equal 
probability. Similarly, a dim-pulse of \h) traveling the 
LP is transmitted away from the SPCM, but a dim-pulse 
of | rep) is reflected toward or transmitted away from the 
SPCM with equal probability. 

We used the differing path lengths, together with fast 
timing electronics gated with narrow coincidence win- 
dows (~ 5 ns), to determine dim-pulse polarizations with 
a single detector. Specifically, a coincidence observed 50 
ns after the bright pulse (early coincidence) informs Bob 
that the dim-pulse was of \rcp), while a coincidence ob- 
served 55 ns after the bright pulse (late coincidence) tells 
Bob that the dim-pulse was of \h). The detector dead 
time was ~ 35 ns. 

A variety of transmitter and receiver configurations 
were used to evaluate the equipment and test out the 
optical elements over optical path lengths of 2-, 36-, and 
205-m, but here we discuss only the 205-m results. The 
205-m experiment was performed with the transmitter 
and receiver colocated in order to simplify data acquisi- 
tion. The 205-m optical path was achieved by sending 
the emitted beam up and down a ~ 17.1-m laboratory 
hallway 6 times with the use of 10 mirrors, and a corner 
cube under fluorescent lighting conditions. 

The corner cube was used to determine the feasibil- 
ity of transmitting single photons from a ground station 
to a low earth orbit satellite covered with corner cubes 
(such as LAGEOS-I and LAGEOS-II) and back. (Note: 
the primary property of the corner cube is its ability to 
return light back along the path it came. However, the 
corner cube also possesses the seldom-noted feature that 
each of its 6 possible optical paths will transform a given 
incident polarization differently M . Because of this, a 
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fully illuminated corner cube cannot be used to perform 
polarization dependent experiments. Therefore, only one 
path through the corner cube was used during the exper- 
iment.) 

The coupling efficiency, 77, between the transmitter and 
receiver for the 205-m path was 77 ~ 2%, where 77 accounts 
for losses between the transmitter and the power coupled 
into the single-mode fibers preceding the detector at the 
receiver. This efficiency led to a bit-rate of ~ 50 Hz when 
the transmitter was pulsed at a rate of ~ 20 kHz over 
the 205-m path, with the system operating at an average 
of ~ 0.7 photons per dim-pulse. The final bit-rate is the 
product of 77 and the probabilities that the weak coherent 
pulse of photons will reach the detector, and the probabil- 
ities that the detector will fire when Poisson distributed 
photons reach the detector. [The detector efficiency is 
a function of the average photon number per dim-pulse, 
and accounts for the probability the detector will fire 
given 1 photon (p(l) - 0.65), 2 photons (p(2) ~ 0.878), 
3 photons (p(3) ~ 0.957), etc., reach the detector. These 
probabilities are convolved with the probabilities that 1, 
2, 3, or more of those photons actually reach the detec- 
tor and then convolved with the Poisson probabilities for 
1, 2, 3, or more photons per dim-pulse (p(l) = 0.348, 
p(2) ~ 0.123, p(3) ~ 0.0284, etc.). These convolutions 
are then summed to give the detection efficiency as a 
function of the Poisson average photon number.] The bit 
error rate (BER) for the 205-m path was ~ 6%, where 
the BER is defined as the ratio of the bits received in er- 
ror to the total number of bits received. A sample of raw 
key material from the 205-m experiment, with errors, is 
shown in TABLE II. 

The narrow coincidence time windows in Bob's receiver 
minimized bit errors due to detector dark noise (~ 80 
Hz); the ambient background was ~ 1 kHz. These low 
noise rates amounted to ~ 1 bit-error every 9 s. After- 
pulsing of the SPCMs caused by the bright pulses con- 
tributed ~ 2% to the total BER — an average rate of 1 
bit-error per second. In addition, bright pulse reflections 
within the transmitter caused the "Is" errors (late coin- 
cidence errors) to be about 6 times higher than the "0s" 
errors (early coincidence). After-pulsing errors could be 
reduced by increasing the length of the fiber delay to 
further separate the bright and dim pulse and should re- 
sult in a BER of ~ 4% — an average rate of 2 bit-errors 
per second; reflection errors could be reduced through 
the use of angle polished fiber termination and should 
result in a BER of ~ 2%. It is important to eliminate re- 
flection errors because these are weaknesses which could 
be exploited by Eve. The BER might be further re- 
duced to ~ 1% by elimination of the common PBS at 
the receiver, and by operating the receiver in a 2 detec- 
tor configuration. The poor coupling efficiency (77 ~ 2%) 
together with the constant average bit-errors caused by 
after-pulsing and reflections (about 3 bit-errors per sec- 
ond) prevented us from effectively operating the proto- 



type system below an average of ~ 0.7 photons per dim- 
pulse. 

This experiment implemented a two-dimensional par- 
ity check scheme which allowed the generation of error 
free key material. The error detection program permit- 
ted the isolation of error free bits from key material with 
BERs exceeding 10%. A further stage of "privacy am- 
plification" is necessary to reduce any partial knowledge 
gained by an eavesdropper to less than 1-bit of infor- 
mation plfl . We have not implemented this protocol at 
this time. Our prototype incorporates a "one time padf]" 
p2| encryption (also known as the Vernam Cipher) — the 
only provably secure encryption method, and could also 
support any other symmetric key system. 

The original form of the B92 protocol jl2| has a weak- 
ness to a "man-in-the middle," or opaque, attack by Eve. 
For instance, Eve could measure Alice's photons in Bob's 
basis and only send a photon, or coherent photon pulse, 
when she identifies a bit. However, if Eve retransmits 
each observed bit as a single-photon (or a weak coherent 
pulse) she will noticeably lower Bob's bit-rate. To com- 
pensate for the additional attenuation to Bob's bit-rate 
Eve could send on a coherent photon pulse of an intensity 
appropriate to raise Bob's bit-rate to a level similar to 
her own bit-rate with Alice. [In fact, if Eve sends a bright 
classical pulse (a pulse of a large average photon number) 
she guarantees that Bob's bit-rate is equal to her own.] 
Our system protects against this scenario when operated 
with two SPCMs. For example, this type of attack would 
be revealed by an increase in "dual-fire" errors which oc- 
cur when both SPCMs fire simultaneously. (In a perfect 
system there would be no "dual-fire" errors, regardless of 
the average photon number per pulse, but in an imperfect 
experimental system, where bit-errors occur, dual-fire er- 
rors will occur.) A better protection would be to use the 
BB84 |H protocol, which our system also supports. 

Over the next few months we intend to implement de- 
sign changes to the transmitter and receiver in order to 
increase system efficiency, 77, and increase the total range 
of the QKD system. Our calculations show that a nar- 
row filter, the spatial filtering and the narrow coincidence 
timing provided by this system will allow reliable key dis- 
tribution under bright daylight conditions. Our goal is 
to exchange key bits outdoors over one or two kilometers 
by the end of 1997. 

Finally, we note that somewhat similar results to these 
presented here are reported in reference [p3[. However, 



1 One time pad encryption utilizes a unique random string of 
key bits to encrypt a single plaintext message. In particular, 
the key bit string exactly the same length as the plaintext 
string and is used only one time. Encryption (decryption) is 
accomplished by XORing the message bits (encrypted bits) 
with the key bits. 
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the protocol of reference j23j was implemented with a 
modulated HeNe laser, utilized long pulse lengths (~ 100 
ns), and active polarization switching at the receiver, 
whereas we implemented our protocol over a line-of-sight 
path 35% longer than in reference |^3) with a system 
which incorporates short pulse lengths (~ 1 ns, and al- 
lows the use of narrow coincidence timing windows to 
minimize ambient background noise allowing daytime ap- 
plications) and passive polarization switching at the re- 
ceiver (a simpler design than in reference p3j ] which will 
be critical for the locating of a receiver, Bob, on a satel- 
lite). 

R. J. H. wishes to extend special thanks to J. G. Rar- 
ity for the many helpful discussions regarding free-space 
quantum cryptography, and W. T. B. extends his appre- 
ciation to S. K. Lamoreaux and A. G. White for their 
helpful conversations. The work described in this letter 
was performed with U. S. Government funding. 
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TABLE I. Observation Probabilities 



Alice's Bit Value 


"0" 


"0" 


"1" 


"1" 


Bob Tests With 


"1" 


"0" 


"1" 


"0" 


Observation Probability 


p=0 






P=0 



TABLE II. A 200-Bit Sample of Alice's (A) and Bob's (B) 
Raw Key Material Generated by Free-Space QKD 



A 


11111010 


10100100 


00110010 


10011011 


01010110 


B 


11111011 


11100000 


00111010 


10011011 


01010110 


A 


00111101 


01101111 


11010000 


01101111 


01011011 


B 


00111101 


01101111 


11010000 


01101111 


01011011 


A 


11100100 


01010001 


10110100 


10110101 


01101011 


B 


11100100 


01010001 


00010100 


10110101 


01101011 


A 


10001011 


11010111 


10101110 


10100111 


00010011 


B 


00001001 


11010111 


10101O10 


10100111 


00010011 


A 


01000010 


00100011 


00111001 


01101100 


01110001 


B 


01000010 


00100011 


00111001 


01101O00 


01110001 




FIG. 1. Free-Space QKD Transmitter (Alice). 



POLARIZATION CONTROLLERS 




FIG. 2. Free-Space QKD Receiver (Bob). 



